Tag Info

Hot answers tagged

62

Having a proxy SSL certificate creates some privacy and security implications: Superfish can impersonate any site This does not mean that Superfish will do it (or is doing), but they have the power. As they have a Certification Authority Certificate, any certificate they generate will be valid and accepted. Certificate pinning does not protect you, ...


36

An encrypted connection is established first before any HTTP requests are performed (e.g. GET, POST, HEAD, etc.), but the hostname and port are visible. There are many other ways to detect which sites you’re visiting as well, for example: your DNS queries (i.e. they’ll see the IP request for secure.logmein.com) via network monitoring (e.g. ...


22

Simple Proxy Servers Even a simple proxy will see and log the names of the servers. For example visiting https://example.com/some/address.html will create a request like this from the browser to the proxy server: CONNECT example.org:443 HTTP/1.1 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:2.0b13pre) ... Proxy-Connection: keep-alive Host: example.org ...


20

As is customary, let's first answer the exact question which was asked. Right now, using HTTPS to connect to the proxy is not widely supported. The squid documentation has some information on the subject; to sum things up: Chrome supports it, but it must be configured through a proxy auto-configuration script because there is no GUI support. This also ...


19

Just because your traffic is passing though a proxy it doesn't mean you are safe. "Transparent" proxies will transmit your IP address using the X-Forwarded-For HTTP header. There are also cookies that can be used to identify you, such as flash's evercookie. You can even be fingerprinted and tracked by the extensions you have installed and what versions ...


18

In Tor, the user (you) chooses a random path through several nodes for its data. The first node in the path knows your IP address, but not what you send or where. The last node ("exit node") knows the target server address and sees the data (unless SSL is used, of course), but not your IP address. Every node in the path knows only the addresses of the ...


17

It is possible, but it requires some setup. Here is how it is done, and how you can tell. On a corporate computer, where software updates are pushed from a central location, it is possible to send to your computer a "trusted" certificate that will be stored next to the trusted certificate of say, Verising or Entrust. Your company's proxy will hold the ...


16

Your forum accepts posts from anybody. That is your core problem. Connecting to your site from various IP throughout the world is trivial, if only by using Tor. Tor provides "high anonymity" in that not only the user's identity is hidden, but each request is anonymous -- you cannot, from the outside, make sure whether two distinct requests are from the same ...


14

SOCKS itself does nothing to protect your data. It simply allows you to proxy your connections through another connection. The SSH connection from your local computer to the SSH server is what is giving you the security, because all traffic that goes through that connection (including your SOCKS traffic) is encrypted. So, any traffic going between the ...


13

From the source of https://www.dnsleaktest.com/: <iframe style="display:none" src="https://1segRNWUwPK0Y21Bm1M0.dnsleaktest.com/"></iframe> <iframe style="display:none" src="https://ldJT4mFLnijeQDBhQX2D.dnsleaktest.com/"></iframe> <iframe style="display:none" src="https://nC4B4vChnPXPshinJoyw.dnsleaktest.com/"></iframe> ...


12

With HTTPS, the SSL/TLS tunnel is established first, and HTTP traffic happens only within that tunnel. Some information still leaks: If the client uses a proxy, the connection to the proxy looks like: CONNECT www.example.com:443 with the target server name. Alternatively, the client could send the target server IP address, but this is only marginally less ...


12

Here are a few risks that you expose yourself to with this specific software: It uses the same private key for each installation. Since the associated is a root CA and is inserted into your private trust list, it makes it trivial for ANYONE to generate any certificate and have it trusted by the affected client (in this case, even server certificate pinning ...


11

The way an investigator would trace a multi-hop connection to the original source is to follow each hop, and examine either the logs (if the connection is closed) or the network state (if the connection is ongoing) to see where the next hop goes. This can get very difficult if the hops cross political or jurisdictional borders, since the cooperation of ...


10

Regarding industry accepted practices: (from http://www.rapid7.com/vulndb/lookup/sslv2-and-up-enabled) "SSLv2 has been deprecated and is no longer recommended. Note that neither SSLv2 nor SSLv3 meet the U.S. FIPS 140-2 standard, which governs cryptographic modules for use in federal information systems. Only the newer TLS (Transport Layer Security) ...


10

TL;DR - I think your problem is not related to SSL at all, but you are trying to use a proxy server without the proxy headers. So, if I use stunnel to create an SSL tunnel, and then pass HTTP traffic through it, would it be the same as using HTTPS normally? Yes. We use http over stunnel at work to talk to an https-server. That's a workaround for a bug ...


10

For tracking what is sent and received, you can use a packet sniffer. I use Wireshark (formerly Ethereal).


10

I am going to assume you are talking about web browsers' private browsing feature. If that's not what you meant, please elaborate. Be warned that private browsing does not protect your anonymity. This is counter-intuitive, so let me explain. What private browsing does provide: Private browsing is designed to protect you against so-called "browser ...


10

Nope, the exit node can only decrypt the message and make the request, but he is not aware of where the original host is located, the only node that knows where the person is located is the second node. This is due to the layered encryption Tor uses. Every node only knows the next and previous hop, but not the whole path. Nope because of 1 Nope because of 1 ...


10

You are correct. Some ways for the site to decrease that attack vector would be to... Use an HSTS header to prevent any data from being sent to the site in plaintext. Advertise only the HTTPS URL and do not allow any plaintext connections. This will ensure most bookmarks use encryption. The point being that sites should force SSL from the beginning, ...


9

Following on Guillaume's answer (sorry, not enough reputation to comment), another way to check for foul play is to use the "Perspectives" Firefox add-on. When visiting an https site it checks (through Internet "notaries") that the public key you receive (via the web server certificate) does indeed belong to the site you're visiting.


9

If the connection uses proxies which are correctly implemented, discovering the ip through http or tcp can be difficult. You may have some luck in getting closer to the ip using DNS instead. for If you generate the page dynamically to contain an image located at a domain that you control, e.g. <img src="http://123123.deanonymize.mydomain.com"/> ...


9

If the URL uses SSL (i.e. is https://) and use the proxy only for transport, then no, the proxy sees only encrypted data and cannot peek at it. (Unless the proxy tries to feed you with a forged certificate, which requires some prior installation of a collaborating CA in your machine; this may happen in work environments, when your enemy is the local ...


9

If websense is configured to log it, then yes, they will be able to see where you went, all the URLs you visit. Content is less likely to be viewed - it depends on how websense/proxy is set up - but it can be done. It depends whether the SSL session is from your browser to the server or if it is just to the proxy (effectively running a man in the middle ...


8

If you're dealing with HTTP (and/or HTTPS) on Windows, Fiddler might help you there: it hooks into Winsock, so it can tell you the program name it will show you all HTTP(s) requests and responses passing through it and it allows you to modify those, either manually or through scripts


8

They can see all of your SSL traffic unencrypted if they use a BlueCoat proxy or similar. Many large Enterprises do this.


8

As a secondary issue, this type of software hides the true nature of how data was encrypted. Because the software replaces known certs with its own, a user does not know much about the original cert. How does the software convey that to the user? If the original cert was out of date or did not match, how would this be sent to the user? If the site is ...


7

Adding to @Piskvor answer - if you need to look at HTTP layer, you should be looking for a intercepting HTTP(s) proxy. There are several such proxies available, both free and commercial ones. If you're on Windows, Fiddler is a good choice. On other platforms you could try: Burp proxy OWASP ZAP OWASP WebScarab All of them will probably be right for the ...


7

This vulnerability forces your proxy to go into an infinite loop, causing a DOS because of exhaustion of local resources like CPU, RAM or any other resource. The reason that it would go into infinite loop is because basically all you're proxy is doing is forwarding requests to someone else. What happens when you tell your proxy to forward the request to ...



Only top voted, non community-wiki answers of a minimum length are eligible